QEMU Guest Agent: symlink and TOCTOU flaws in SSH key injection give root inside the guest

Impact

qemu-ga runs as root inside the guest. An unprivileged guest user can pre-stage a directory symlink, or win a time-of-check/time-of-use race on a file symlink, so that a guest-ssh-add-authorized-keys call hands them ownership of an arbitrary root-owned file or directory - and from there, root in the guest. The escalation is guest-local: on its own it does not reach the host or another VM. For GPU clouds that rent whole VMs with passthrough accelerators the tenant is typically already root in their own VM, so the exposure is really on guests with multiple accounts - shared research VMs, multiuser images, or GPU VMs whose interactive users are deliberately kept unprivileged. The path only opens when an external management layer such as libvirt actually invokes the command.

Who can reach it

Local unprivileged user inside a guest running qemu-ga, on a platform where libvirt or another management layer calls guest-ssh-add-authorized-keys. No host or hypervisor access required.

What to do

Update the qemu-guest-agent package inside guest images and restart the agent. This is a guest-side package rather than a host QEMU update, so it rolls out with a golden-image refresh and per-guest restart - no hypervisor maintenance window and no GPU node reboot. Where images cannot be refreshed quickly, block the guest-ssh-add-authorized-keys command via the qemu-ga allow/block list. Red Hat's CVE page carries the per-RHEL fixed builds; the NVD record names no fixed version.

References

Related entries

• Linux kernel (net/xfrm, net/key): No memory corruption here, but a clean namespace boundary break. SA migrationCVE-2026-63914 · Linux kernel (net/xfrm, net/key)High
• zbus_polkit: caller-supplied UID is silently discarded, leaving polkit authorization open to a PID-reuse raceCVE-2026-78422 · zbus_polkit Rust crate (Subject::new_for_owner UID encoding)High
• OpenZFS: ioctl checks accept unprivileged user-namespace capabilities, granting local pool adminCVE-2026-79619 · OpenZFS on Linux (/dev/zfs ioctl privilege checks vs. unprivileged user namespaces)High
• Linux kernel eBPF: syncookie helpers read sk_protocol on mini-sockets without a fullsock checkCVE-2026-80738 · Linux kernel eBPF (bpf_tcp_gen_syncookie / bpf_tcp_check_syncookie helpers)High
• Xen on AMD - x86 HVM pagetable height update: AMD HVM guest OS users can trigger a data-structure access during aCVE-2019-19577 · Xen on AMD - x86 HVM pagetable height updateHigh
• IBM Spectrum Scale kernel module: An unauthenticated local trigger takes down the Spectrum Scale kernel module and withCVE-2020-4411 · IBM Spectrum Scale kernel moduleHigh